Date: Wed, 28 Apr 2021 16:37:47 -0600 (MDT)
From: Ariadne Conill <ariadne@dereferenced.org>
To: Nir Ben-Eliezer <nir.ben-eliezer@aquasec.com>
cc: Ariadne Conill <ariadne@dereferenced.org>, 
    "~alpine/devel@lists.alpinelinux.org" <~alpine/devel@lists.alpinelinux.org>
Subject: RE: Security dispute over nodejs vulnerability in Alpine - Help!
In-Reply-To: <AM6PR03MB47116AB82476787EBC7881F0B3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
Message-ID: <f45f3555-d68b-fc8a-17a6-d19e63f734c5@dereferenced.org>
References: <AM6PR03MB471180AD19195D25E1BC462AB3409@AM6PR03MB4711.eurprd03.prod.outlook.com>  <AM6PR03MB47117F359009F8F9A1231595B3409@AM6PR03MB4711.eurprd03.prod.outlook.com> <617756a6-b38c-aa47-86bd-269661b85522@dereferenced.org> 
 <AM6PR03MB47116AB82476787EBC7881F0B3409@AM6PR03MB4711.eurprd03.prod.outlook.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed

Hello,

On Wed, 28 Apr 2021, Nir Ben-Eliezer wrote:

> Hi Ariadne, and thank you very much for your quick response.
>
> I am asking this on behalf of one of our customers. I've used three different scanners, all yield the same result, identifying nodejs v12.20.1 as vulnerable in Alpine 3.13, and recommending to upgrade it to v14.15.4-r0, where it is fixed.
>
> The reason why the scanners behave this way is due to the information listed on this page:https://git.alpinelinux.org/aports/blame/main/nodejs/APKBUILD?h=3.13-stable. If you scroll down to rows 18-19, you'll see this:
> +#   14.15.4-r0:
> +#     - CVE-2020-8265
> +#     - CVE-2020-8287
>
> Indicating that CVE-2020-8265 is fixed in nodejs 14.15.4-r0 on Alpine's 3.13 branch. I did not find any place indicating that nodejs v12.20.1 also contains the fix in Alpine branch 3.13.

It appears that your scanners are probably using our security databases 
incorrectly, or at least making the wrong assumptions about how the 
version lifecycle works in secfixes land.

To explain: we publish security databases for every branch of Alpine, 
these can be fetched at https://secdb.alpinelinux.org/.  These databases 
are compiled from the perspective of each branch.  Or in other words, they 
only describe versions that are published in that branch.

Incidentally, one or more security companies are presently scraping our 
cgit instance for this information.  It may be that you have stale 
information about the v3.13 branch if your security scanners were doing
this, as we have recently taken action to stop abuse of our cgit instance 
for this purpose.  In that case, see the above note about 
secdb.alpinelinux.org and you will have more reliable data.

Anyway, Alpine 3.13 does not credit v12.20.1 with the fix for 
CVE-2020-8265 because that version was never published in Alpine 3.13, 
only Alpine 3.12.

Each security database publishes information based on what packages have 
been published in that branch.

You may also wish to look at our security database viewer at 
https://security.alpinelinux.org/vuln/CVE-2020-8265, which shows both 
Alpine 3.12 and 3.13 having fixes in their respective versions of Node.

You can query that as a webservice, by sending the `Accept: 
application/ld+json` header, in which case you will be presented with 
parts of a JSON-LD graph containing the relevant data.  Please be kind 
when querying that webservice though.  The software powering it is public, 
and you should run your own instance of it if you decide to make bulk 
queries.

Ariadne